hyperframes-motion-graphics
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, which is a common vulnerability surface for indirect prompt injection.
- Ingestion points: The
webpage,news, andtweetcategories ingest content from user-provided or search-returned URLs (categories/webpage/module.md,categories/news/module.md,categories/tweet/module.md). - Boundary markers: The skill includes some sanitization practices, such as SVG sanitization mentioned in the Figma source instructions and result verification for web captures.
- Capability inventory: The skill utilizes the
hyperframesCLI toolset for composition building and rendering, runs local Node.js scripts for specialized tasks, and invokesffmpegfor video encoding. - Sanitization: No explicit "ignore embedded instructions" wrappers were observed for the ingested textual content.
- [EXTERNAL_DOWNLOADS]: The skill fetches resources from well-known and trusted services to perform its functions.
- It downloads MapLibre, TopoJSON, and World Atlas data from the
jsdelivr.netCDN for map rendering (categories/maps/bake-basemap.mjs). - It incorporates the GSAP animation library from
jsdelivr.netin its HTML templates (samples/asset-fusion/_ref-circle-highlight.html). - It fetches images and icons from established sources like Wikimedia, Google Images, and the Noun Project during the sourcing phase (
phases/source/guide.md). - It suggests installing the
chrome-headless-shellbinary vianpx puppeteerfor headless browser operations. - [COMMAND_EXECUTION]: The skill executes local system commands for media processing and project management.
- It uses
ffmpegandffprobeto probe media files, encode video frames, and apply overlays (grounding/locate.mjs,categories/maps/bake-basemap.mjs). - It relies on various
npx hyperframescommands (init, add, lint, check, snapshot, preview, render) for project orchestration. - [DYNAMIC_EXECUTION]: The skill utilizes a headless browser for rendering tasks.
- The
bake-basemap.mjsscript launchespuppeteerto render geographic basemaps using MapLibre GL JS within a headless Chrome environment.
Audit Metadata